CVE-2024-32046: Detailed error discloses full file path with dev mode off
First published: Fri Apr 26 2024(Updated: )
Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored
Credit: responsibledisclosure@mattermost.com responsibledisclosure@mattermost.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/mattermost/mattermost-server | >=9.4.0<=9.4.4 | 9.4.5 |
| go/github.com/mattermost/mattermost-server | >=9.6.0-rc1<=9.6.0 | 9.6.1 |
| go/github.com/mattermost/mattermost-server | >=9.5.0<=9.5.2 | 9.5.3 |
| go/github.com/mattermost/mattermost-server | >=8.1.0<=8.1.11 | 8.1.12 |
Remedy
Update Mattermost to versions 9.7.0, 9.6.1, 9.5.3, 9.4.5, 8.1.12 or higher.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://mattermost.com/security-updates
- https://nvd.nist.gov/vuln/detail/CVE-2024-32046
- https://github.com/mattermost/mattermost/commit/2a48b5b3428cae494452125401e4f72780543ac8
- https://github.com/mattermost/mattermost/commit/93738756ff79777c6e340c8de63a7b4b0f881d27
- https://github.com/mattermost/mattermost/commit/aa222c66b799c12e32eeb8eae6f555bf6140375b
- https://github.com/mattermost/mattermost/commit/c84c25b20c8b8726a2f126ae9370a72498096172
- https://github.com/advisories/GHSA-vx97-8q8q-qgq5 (Advisory)
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/title
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/description
- agent/severity
- collector/nvd-api
- source/NVD
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-vx97-8q8q-qgq5
- alias/CVE-2024-32046
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/references
- agent/event
- collector/nvd-cve
- agent/author
- agent/tags
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/github-advisory
- package-manager/go